2023-05-21 18:37:59 +02:00
|
|
|
package db
|
2021-04-23 00:25:01 +02:00
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/rand"
|
|
|
|
"encoding/hex"
|
2021-06-24 15:44:19 +02:00
|
|
|
"errors"
|
2022-05-30 15:31:06 +02:00
|
|
|
"fmt"
|
2022-08-25 12:43:15 +02:00
|
|
|
"strings"
|
2021-04-23 00:25:01 +02:00
|
|
|
"time"
|
2021-06-24 15:44:19 +02:00
|
|
|
|
2023-05-21 18:37:59 +02:00
|
|
|
"github.com/juanfont/headscale/hscontrol/types"
|
2021-06-24 15:44:19 +02:00
|
|
|
"gorm.io/gorm"
|
2024-07-18 10:01:59 +02:00
|
|
|
"tailscale.com/types/ptr"
|
2024-09-29 13:00:27 +02:00
|
|
|
"tailscale.com/util/set"
|
2021-04-23 00:25:01 +02:00
|
|
|
)
|
|
|
|
|
2023-05-11 09:09:18 +02:00
|
|
|
var (
|
|
|
|
ErrPreAuthKeyNotFound = errors.New("AuthKey not found")
|
|
|
|
ErrPreAuthKeyExpired = errors.New("AuthKey expired")
|
|
|
|
ErrSingleUseAuthKeyHasBeenUsed = errors.New("AuthKey has already been used")
|
|
|
|
ErrUserMismatch = errors.New("user mismatch")
|
|
|
|
ErrPreAuthKeyACLTagInvalid = errors.New("AuthKey tag is invalid")
|
2021-11-04 23:14:39 +01:00
|
|
|
)
|
2021-05-05 23:00:04 +02:00
|
|
|
|
2023-05-11 09:09:18 +02:00
|
|
|
func (hsdb *HSDatabase) CreatePreAuthKey(
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 14:50:17 +02:00
|
|
|
// TODO(kradalby): Should be ID, not name
|
2023-01-17 17:43:44 +01:00
|
|
|
userName string,
|
2021-11-04 23:14:39 +01:00
|
|
|
reusable bool,
|
|
|
|
ephemeral bool,
|
|
|
|
expiration *time.Time,
|
2022-08-25 12:03:38 +02:00
|
|
|
aclTags []string,
|
2023-05-21 18:37:59 +02:00
|
|
|
) (*types.PreAuthKey, error) {
|
2024-02-08 17:28:19 +01:00
|
|
|
return Write(hsdb.DB, func(tx *gorm.DB) (*types.PreAuthKey, error) {
|
|
|
|
return CreatePreAuthKey(tx, userName, reusable, ephemeral, expiration, aclTags)
|
|
|
|
})
|
|
|
|
}
|
2023-07-17 13:35:05 +02:00
|
|
|
|
2024-02-08 17:28:19 +01:00
|
|
|
// CreatePreAuthKey creates a new PreAuthKey in a user, and returns it.
|
|
|
|
func CreatePreAuthKey(
|
|
|
|
tx *gorm.DB,
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 14:50:17 +02:00
|
|
|
// TODO(kradalby): Should be ID, not name
|
2024-02-08 17:28:19 +01:00
|
|
|
userName string,
|
|
|
|
reusable bool,
|
|
|
|
ephemeral bool,
|
|
|
|
expiration *time.Time,
|
|
|
|
aclTags []string,
|
|
|
|
) (*types.PreAuthKey, error) {
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 14:50:17 +02:00
|
|
|
user, err := GetUserByUsername(tx, userName)
|
2021-04-23 00:25:01 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2024-09-29 13:00:27 +02:00
|
|
|
// Remove duplicates
|
|
|
|
aclTags = set.SetOf(aclTags).Slice()
|
|
|
|
|
|
|
|
// TODO(kradalby): factor out and create a reusable tag validation,
|
|
|
|
// check if there is one in Tailscale's lib.
|
2022-08-25 12:43:15 +02:00
|
|
|
for _, tag := range aclTags {
|
|
|
|
if !strings.HasPrefix(tag, "tag:") {
|
2023-05-11 09:09:18 +02:00
|
|
|
return nil, fmt.Errorf(
|
|
|
|
"%w: '%s' did not begin with 'tag:'",
|
|
|
|
ErrPreAuthKeyACLTagInvalid,
|
|
|
|
tag,
|
|
|
|
)
|
2022-08-25 12:43:15 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-04-23 00:25:01 +02:00
|
|
|
now := time.Now().UTC()
|
2024-02-08 17:28:19 +01:00
|
|
|
kstr, err := generateKey()
|
2021-04-23 00:25:01 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-05-21 18:37:59 +02:00
|
|
|
key := types.PreAuthKey{
|
2023-01-17 20:36:46 +01:00
|
|
|
Key: kstr,
|
|
|
|
UserID: user.ID,
|
|
|
|
User: *user,
|
|
|
|
Reusable: reusable,
|
|
|
|
Ephemeral: ephemeral,
|
|
|
|
CreatedAt: &now,
|
|
|
|
Expiration: expiration,
|
2024-10-02 11:41:58 +02:00
|
|
|
Tags: aclTags,
|
2021-04-23 00:25:01 +02:00
|
|
|
}
|
2022-05-30 15:31:06 +02:00
|
|
|
|
2024-02-08 17:28:19 +01:00
|
|
|
if err := tx.Save(&key).Error; err != nil {
|
|
|
|
return nil, fmt.Errorf("failed to create key in the database: %w", err)
|
|
|
|
}
|
2022-08-25 12:03:38 +02:00
|
|
|
|
2021-11-15 17:15:50 +01:00
|
|
|
return &key, nil
|
2021-04-23 00:25:01 +02:00
|
|
|
}
|
|
|
|
|
2023-05-21 18:37:59 +02:00
|
|
|
func (hsdb *HSDatabase) ListPreAuthKeys(userName string) ([]types.PreAuthKey, error) {
|
2024-02-08 17:28:19 +01:00
|
|
|
return Read(hsdb.DB, func(rx *gorm.DB) ([]types.PreAuthKey, error) {
|
|
|
|
return ListPreAuthKeys(rx, userName)
|
|
|
|
})
|
2023-07-17 13:35:05 +02:00
|
|
|
}
|
|
|
|
|
2024-02-08 17:28:19 +01:00
|
|
|
// ListPreAuthKeys returns the list of PreAuthKeys for a user.
|
|
|
|
func ListPreAuthKeys(tx *gorm.DB, userName string) ([]types.PreAuthKey, error) {
|
Redo OIDC configuration (#2020)
expand user, add claims to user
This commit expands the user table with additional fields that
can be retrieved from OIDC providers (and other places) and
uses this data in various tailscale response objects if it is
available.
This is the beginning of implementing
https://docs.google.com/document/d/1X85PMxIaVWDF6T_UPji3OeeUqVBcGj_uHRM5CI-AwlY/edit
trying to make OIDC more coherant and maintainable in addition
to giving the user a better experience and integration with a
provider.
remove usernames in magic dns, normalisation of emails
this commit removes the option to have usernames as part of MagicDNS
domains and headscale will now align with Tailscale, where there is a
root domain, and the machine name.
In addition, the various normalisation functions for dns names has been
made lighter not caring about username and special character that wont
occur.
Email are no longer normalised as part of the policy processing.
untagle oidc and regcache, use typed cache
This commits stops reusing the registration cache for oidc
purposes and switches the cache to be types and not use any
allowing the removal of a bunch of casting.
try to make reauth/register branches clearer in oidc
Currently there was a function that did a bunch of stuff,
finding the machine key, trying to find the node, reauthing
the node, returning some status, and it was called validate
which was very confusing.
This commit tries to split this into what to do if the node
exists, if it needs to register etc.
Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2024-10-02 14:50:17 +02:00
|
|
|
user, err := GetUserByUsername(tx, userName)
|
2021-04-23 00:25:01 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-05-21 18:37:59 +02:00
|
|
|
keys := []types.PreAuthKey{}
|
2024-09-29 13:00:27 +02:00
|
|
|
if err := tx.Preload("User").Where(&types.PreAuthKey{UserID: user.ID}).Find(&keys).Error; err != nil {
|
2021-04-23 00:25:01 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-11-04 23:14:39 +01:00
|
|
|
return keys, nil
|
2021-04-23 00:25:01 +02:00
|
|
|
}
|
|
|
|
|
2021-11-13 09:39:04 +01:00
|
|
|
// GetPreAuthKey returns a PreAuthKey for a given key.
|
2024-02-08 17:28:19 +01:00
|
|
|
func GetPreAuthKey(tx *gorm.DB, user string, key string) (*types.PreAuthKey, error) {
|
|
|
|
pak, err := ValidatePreAuthKey(tx, key)
|
2021-08-08 00:10:30 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-01-17 17:43:44 +01:00
|
|
|
if pak.User.Name != user {
|
|
|
|
return nil, ErrUserMismatch
|
2021-08-08 00:10:30 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
return pak, nil
|
|
|
|
}
|
|
|
|
|
2021-11-13 20:01:05 +01:00
|
|
|
// DestroyPreAuthKey destroys a preauthkey. Returns error if the PreAuthKey
|
|
|
|
// does not exist.
|
2024-02-08 17:28:19 +01:00
|
|
|
func DestroyPreAuthKey(tx *gorm.DB, pak types.PreAuthKey) error {
|
|
|
|
return tx.Transaction(func(db *gorm.DB) error {
|
2022-08-25 12:03:38 +02:00
|
|
|
if result := db.Unscoped().Delete(pak); result.Error != nil {
|
|
|
|
return result.Error
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
})
|
2021-11-13 20:01:05 +01:00
|
|
|
}
|
|
|
|
|
2023-05-21 18:37:59 +02:00
|
|
|
func (hsdb *HSDatabase) ExpirePreAuthKey(k *types.PreAuthKey) error {
|
2024-02-08 17:28:19 +01:00
|
|
|
return hsdb.Write(func(tx *gorm.DB) error {
|
|
|
|
return ExpirePreAuthKey(tx, k)
|
|
|
|
})
|
|
|
|
}
|
2023-07-17 13:35:05 +02:00
|
|
|
|
2024-02-08 17:28:19 +01:00
|
|
|
// MarkExpirePreAuthKey marks a PreAuthKey as expired.
|
|
|
|
func ExpirePreAuthKey(tx *gorm.DB, k *types.PreAuthKey) error {
|
|
|
|
if err := tx.Model(&k).Update("Expiration", time.Now()).Error; err != nil {
|
2021-08-07 23:57:52 +02:00
|
|
|
return err
|
|
|
|
}
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-08-07 23:57:52 +02:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-02-28 09:06:39 +01:00
|
|
|
// UsePreAuthKey marks a PreAuthKey as used.
|
2024-02-08 17:28:19 +01:00
|
|
|
func UsePreAuthKey(tx *gorm.DB, k *types.PreAuthKey) error {
|
2022-02-28 09:06:39 +01:00
|
|
|
k.Used = true
|
2024-02-08 17:28:19 +01:00
|
|
|
if err := tx.Save(k).Error; err != nil {
|
2022-05-30 15:31:06 +02:00
|
|
|
return fmt.Errorf("failed to update key used status in the database: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
2022-02-28 09:06:39 +01:00
|
|
|
}
|
|
|
|
|
2023-05-21 18:37:59 +02:00
|
|
|
func (hsdb *HSDatabase) ValidatePreAuthKey(k string) (*types.PreAuthKey, error) {
|
2024-02-08 17:28:19 +01:00
|
|
|
return Read(hsdb.DB, func(rx *gorm.DB) (*types.PreAuthKey, error) {
|
|
|
|
return ValidatePreAuthKey(rx, k)
|
|
|
|
})
|
|
|
|
}
|
2023-07-17 13:35:05 +02:00
|
|
|
|
2024-02-08 17:28:19 +01:00
|
|
|
// ValidatePreAuthKey does the heavy lifting for validation of the PreAuthKey coming from a node
|
|
|
|
// If returns no error and a PreAuthKey, it can be used.
|
|
|
|
func ValidatePreAuthKey(tx *gorm.DB, k string) (*types.PreAuthKey, error) {
|
2023-05-21 18:37:59 +02:00
|
|
|
pak := types.PreAuthKey{}
|
2024-09-29 13:00:27 +02:00
|
|
|
if result := tx.Preload("User").First(&pak, "key = ?", k); errors.Is(
|
2021-11-13 09:36:45 +01:00
|
|
|
result.Error,
|
|
|
|
gorm.ErrRecordNotFound,
|
|
|
|
) {
|
2022-07-29 17:35:21 +02:00
|
|
|
return nil, ErrPreAuthKeyNotFound
|
2021-05-05 23:00:04 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if pak.Expiration != nil && pak.Expiration.Before(time.Now()) {
|
2022-07-29 17:35:21 +02:00
|
|
|
return nil, ErrPreAuthKeyExpired
|
2021-05-05 23:00:04 +02:00
|
|
|
}
|
|
|
|
|
2024-03-03 11:11:10 +01:00
|
|
|
if pak.Reusable { // we don't need to check if has been used before
|
2021-05-06 00:08:36 +02:00
|
|
|
return &pak, nil
|
|
|
|
}
|
|
|
|
|
2023-09-24 13:42:05 +02:00
|
|
|
nodes := types.Nodes{}
|
2024-02-08 17:28:19 +01:00
|
|
|
if err := tx.
|
2023-07-17 13:35:05 +02:00
|
|
|
Preload("AuthKey").
|
2024-07-18 10:01:59 +02:00
|
|
|
Where(&types.Node{AuthKeyID: ptr.To(pak.ID)}).
|
2023-09-24 13:42:05 +02:00
|
|
|
Find(&nodes).Error; err != nil {
|
2021-05-06 00:08:36 +02:00
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
2023-09-24 13:42:05 +02:00
|
|
|
if len(nodes) != 0 || pak.Used {
|
2022-07-29 17:35:21 +02:00
|
|
|
return nil, ErrSingleUseAuthKeyHasBeenUsed
|
2021-05-06 00:08:36 +02:00
|
|
|
}
|
|
|
|
|
2021-05-05 23:00:04 +02:00
|
|
|
return &pak, nil
|
|
|
|
}
|
|
|
|
|
2024-02-08 17:28:19 +01:00
|
|
|
func generateKey() (string, error) {
|
2021-04-23 00:25:01 +02:00
|
|
|
size := 24
|
|
|
|
bytes := make([]byte, size)
|
|
|
|
if _, err := rand.Read(bytes); err != nil {
|
|
|
|
return "", err
|
|
|
|
}
|
2021-11-14 16:46:09 +01:00
|
|
|
|
2021-04-23 00:25:01 +02:00
|
|
|
return hex.EncodeToString(bytes), nil
|
|
|
|
}
|